Top Risks

• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• content_scripts match <all_urls> giving code execution reach on every site despite narrow declared permissions.
• No CSP present (MV3 default only); bundled jszip uses new Function() constructor in minified lib.
• Extension is ~23 months stale (near zombie threshold) with only 358 installs — low accountability.
• Description promises download but lacks 'downloads' permission — permission/promise mismatch.

Evidence

• content_scripts_all_urls manifest content_scripts_matches=["<all_urls>"] — code injected on every page visited.
• privacy_policy_generic store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, not extension-scoped; data_collection+3rd_party_sharing=true.
• function_constructor_in_lib crx libs/jszip.min.js uses new Function() constructor; no CSP to mitigate eval-class risks.
• description_permission_mismatch store Description promises download capability but 'downloads' permission is absent from manifest.
• stale_extension store Last updated July 2024; 23 months since update — approaching zombie threshold.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening.
• js_external_hosts crx Fingerprint references github.com, raw.github.com, stuartk.com, stuk.github.io — JSZip library provenance.
• low_installs_unverified store 358 installs, not verified publisher, no featured badge — limited accountability signals.

Permissions Breakdown

• activeTab low Scoped to current tab only on user gesture; limited blast radius.
• scripting medium Can inject scripts into pages; combined with content_scripts <all_urls> elevates risk.
• content_scripts <all_urls> high Runs on every site the user visits; broad reach even without explicit host_permissions.

Pillar Scores

Bookkeeping